fix(boatstack): reconcile stale update receipts

[bigboateng]

Summary

• verify the current generated bundle, hooks, runtime identities, and integrations before consuming a previously successful update receipt
• reopen only an install-update with ATOMIC_LOCAL retry semantics when its repository postcondition no longer holds
• preserve terminal duplicate suppression for generic tools, captures, and PR publication
• document the recovery path and add an append-only release note

Why the earlier fix was incomplete

The earlier change repaired detached path ownership and invalid local provenance. Its end-to-end test stopped after the first successful update, so it did not cover a later restoration of the old committed pin while the detached success receipt survived. That receipt then suppressed regeneration.

Test plan

• go vet ./...
• go build ./cmd/boatstack-helper
• go test ./...
• bash -n ../boatstack-distribution/install.sh.template
• python3 -m unittest discover -s labs/12-product-engineering-loop/tests -p "test_*.py"
• Boatstack release-note validation and append-only policy checks
• detached E2E: update succeeds, generated diff is restored to the old pin, clean retry reconciles the terminal receipt and regenerates the target
• negative conformance: generic terminal operations cannot be reopened

Disclosure reviewed: public-safe implementation and synthetic fixtures only.